nodejs / nodejs/package-maintenance
Idea: #236 Standard grammar for node release lines and security
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 423
- Forks
- 147
- PR merge metrics
- No merged PRs in 30d
Description
I propose an addition to the alias specification:
An alias should never resolve to a version of Node.js with known security vulnerabilities
This would require that implementations of the alias's would need a way to look up which versions of Node have known security issues. What it would do is give the node ecosystem an even better way to support and test against known good versions of Node.
What do folks think about this addition?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing issue #236 and the alias specification referenced in this proposal. Determine whether the specification has an established source for Node.js security advisories and what changes would be required for implementations; the work is done when the proposal has a decided scope and an agreed specification or implementation path.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nodejs
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100